# Content-Type の厳格チェック { #strict-content-type-checking }

既定では、FastAPI は JSON リクエストボディに対して厳格な `Content-Type` ヘッダーのチェックを行います。つまり、JSON のリクエストを JSON として解析するには、有効な `Content-Type` ヘッダー（例: `application/json`）を必ず含める必要があります。

## CSRF のリスク { #csrf-risk }

この既定の挙動は、ある特定の状況における Cross-Site Request Forgery（CSRF）攻撃の一種に対する保護を提供します。

これらの攻撃は、次の条件を満たすときにブラウザが CORS のプリフライトチェックを行わずにスクリプトからリクエストを送信できる事実を悪用します。

- `Content-Type` ヘッダーがない（例: `Blob` をボディにして `fetch()` を使う）

Guillaume Nodet <******@****.***> 1729859506 +0200

    private val CRLF = byteArrayOf('\r'.code.toByte(), '\n'.code.toByte())
    private val DASHDASH = byteArrayOf('-'.code.toByte(), '-'.code.toByte())

    /**
     * Appends a quoted-string to a StringBuilder.
     *
     * RFC 2388 is rather vague about how one should escape special characters in form-data
     * parameters, and as it turns out Firefox and Chrome actually do rather different things, and

        sink.writeByte((length shr shift).toInt())
      }
    }

    // Write the payload.
    sink.writeAll(content)
  }

  /**
   * Execute [block] with a new namespace for type hints. Type hints from the enclosing type are no
   * longer usable by the current type's members.
   */
  fun <T> withTypeHint(block: () -> T): T {
    typeHintStack.add(null)
    try {
      return block()
    } finally {

        } else if (type == Byte.class) {
            return ByteConversionUtil.toByte(o);
        }
        return o;
    }

    /**
     * Converts to the wrapper type corresponding to the specified primitive type.
     *
     * @param type
     *            Primitive type
     * @param o
     *            Source object
     * @return Object converted to the wrapper type corresponding to the specified primitive type

          if (readByte() != '.'.code.toByte()) throw IOException("expected '..'")
          readHexadecimalUnsignedLong()
        }

        else -> {
          sourceCodePoint0
        }
      }

    skipWhitespace()
    if (readByte() != ';'.code.toByte()) throw IOException("expected ';'")

    // "valid" or "mapped"
    skipWhitespace()
    val type = select(optionsType)

    when (type) {

     *
     * @return The type of the token.
     */
    public int nextToken() {
        initVal();
        if (processEOF()) {
            return ttype;
        }
        if (processWhitespace()) {
            return ttype;
        }
        if (processWord()) {
            return ttype;
        }
        if (processQuote()) {
            return ttype;
        }

     *
     * @param type
     *            the type
     * @param map
     *            a {@link Map} with type variables as keys and type arguments as values for the parameterized type
     * @return a {@link ParameterizedClassDesc} representing the type
     */
    protected static ParameterizedClassDesc createParameterizedClassDesc(final Type type, final Map<TypeVariable<?>, Type> map) {

      limit = pushedLimit
      constructed = pushedConstructed
      if (name != null) path.removeAt(path.size - 1)
    }
  }

  /**
   * Execute [block] with a new namespace for type hints. Type hints from the enclosing type are no
   * longer usable by the current type's members.
   */
  fun <T> withTypeHint(block: () -> T): T {
    typeHintStack.add(null)
    try {
      return block()
    } finally {

// dataUsageHash is the hash type used.
type dataUsageHash string

// sizeHistogramV1 is size histogram V1, which has fewer intervals esp. between
// 1024B and 1MiB.
type sizeHistogramV1 [dataUsageBucketLenV1]uint64

// sizeHistogram is a size histogram.
type sizeHistogram [dataUsageBucketLen]uint64

// versionsHistogram is a histogram of number of versions in an object.
type versionsHistogram [dataUsageVersionLen]uint64